[wtn]

PluggableAuthCredentials#retrieve_subject_token! reads timeout_millis from the executable credential source, defaults it to 30000, checks it against the documented 5000 to 120000 bounds, and then passes it unchanged to subprocess_with_timeout, which hands it to Timeout.timeout. Timeout.timeout takes seconds, so the default allows the helper to run for 30000 seconds, over eight hours, and the bounds check never constrains anything at run time.

Converting the units is not enough on its own. subprocess_with_timeout wraps Open3.capture3, which runs inside Open3.popen_run, whose ensure closes the pipes and joins the child. When Timeout raises inside the block, that ensure waits for the helper to exit, so the error surfaces only after the helper finishes by itself, and each expiry prints two IOError: stream closed in another thread backtraces from the reader threads:

creds = Google::Auth::ExternalAccount::PluggableAuthCredentials.new(
  audience: "a", subject_token_type: "t", token_url: "https://x",
  credential_source: { executable: { command: "sleep 3" } },
)
creds.send(:subprocess_with_timeout, {}, "sleep 3", 0.5)
# => Timeout::Error after 3.01s

subprocess_with_timeout now uses Open3.popen3 with pgroup: true on POSIX, reads stdout and stderr on threads with report_on_exception off, and computes one monotonic deadline from timeout_millis / 1000.0. The process wait and both reader joins are bounded by the time remaining on that deadline, so a background child that inherits stdout cannot extend the wait past it. If any of them runs out, a Google::Auth::CredentialsError is raised, as the method's @raise already promised. An ensure on the popen3 block sends SIGKILL to the process group whenever the block leaves before the helper has been reaped. That covers the deadline, and it also covers an Interrupt in the caller, which the helper would otherwise outlive because its own process group no longer receives the terminal's Ctrl-C. On Windows Process.kill reaches only the direct process, so no process group is requested there.

The new specs fail on main and pass with this change.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[wtn]

@googlebot I signed it!

[quartzmo]

@wtn The CLA check is failing for noreply@anthropic.com.

It's in your commit message:

Co-Authored-By: Claude Mythos 5.1 <noreply@anthropic.com>